#1Tools for maintaining long-term access to compromised systems, even after reboots.
Kitploit recommended
vulnquest58/dirtyclone-exploitCVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9
f4r3sx0/ios-bluetooth-ethernet-exploitiOS Bluetooth PAN vulnerability that opens USB port 62078 and displays Ethernet icon without any adapter (€0). Apple sells a €89.95 adapter for the…
kill1234545/cve-2026-41940cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)
gmh5225/driver-kalderetaUnsigned Kernel Mode Driver that does memory modifications
deadexpl0it/cve-2026-78006-pocPOC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
gmh5225/driver-hidekernelthread-iocancelirpWindows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…
asmitdesai/ubuntilsPython CLI/TUI for forensic triage of Ubuntu systems — detects and remediates persistence mechanisms with artifact collection, timeline correlation,…
x3r0day/fud-c2-frameworkA fileless reverse shell and C2 framework leveraging direct syscalls, proxy tunneling, and ChaCha20 encryption for AV evasion.
diego-tella/codeineLinux LKM Rootkit
kitsuneshade/winrar-exploit-tool---rust-editionA high-performance, memory-safe implementation of the WinRAR CVE-2025-8088 exploit tool, rewritten in Rust for better reliability and performance.
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
ic3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…
davidkowalk/arduino-netcat-backdoor*Proof of concept* Attacks a Windows machine running Windows 7 or later, creating a persistent Backdoor.
kaandemir993/python-shellcode-anydesk-apc-injection-remote-ip-address-analysisReverse engineering write-up of Python shellcode that APC-injects into AnyDesk, exfiltrates to a C2 over HTTPS with AES/RSA, and persists via…
shadowforge-cyber/cve-2026-104286-pocUnauthenticated path traversal exploit for CVE-2026-104286 in FortiMail, writing arbitrary files via crafted HTTP/HTTPS requests for red team…
quinnbast/malicious-mcpA Proof-of-concept repository showing how an untrusted MCP server can steal literally everything...
atlasvector/kestra-cve-2026-53576End-to-end reproduction and cross-layer detection of CVE-2026-53576, the unauthenticated RCE in Kestra - taken past the base PoC to show how a common…
